CVE-2026-124552
4.8 MEDIUMpublic exploit availablePublished 2026-11-08 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, including root, view the list page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Public exploit & PoC references
All references
- https://github.com/webmin/webmin
- https://github.com/webmin/webmin/blob/2.670/shorewall/list.cgi#L56-L78
- https://github.com/webmin/webmin/blob/2.670/shorewall6/list.cgi#L58-L75
- https://github.com/webmin/webmin/commit/01b988dbf1e8f9926eec4b041d913167e0cc280f
- https://github.com/webmin/webmin/issues/2908
- https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-shorewall-and-shorewall6-list-cgi
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2012-20003PoC
- MEDIUMCVE-2012-20004PoC
- MEDIUMCVE-2012-20005PoC
- MEDIUMCVE-2013-20009PoC
- MEDIUMCVE-2014-125131PoC
- MEDIUMCVE-2014-125132PoC
- MEDIUMCVE-2015-20130PoC
- MEDIUMCVE-2016-20098PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.